Zero Radar
← feed
HighVulnerabilityCVE-2026-76493updated 27 Oct 2026, 14:49 UTC

Cisco Expressway: crashes from unhandled errors, exploited in the wild

Attackers can send specially crafted input that makes Cisco Expressway devices fail in an uncontrolled way. Cisco confirms this flaw is being exploited.

Exploited (Cisco PSIRT)Fix availableOfficial, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?YesConfirmed by Cisco PSIRT · 27 Oct 2026
Fix available?YesCisco software update released with the October 2026 Expressway Series Security Hardening Release. Specific fixed version numbers: unknown; see the Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs. · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

What happened

CVE-2026-76493 is a group of uncaught-exception flaws (CWE-248) in Cisco Expressway Series software, covering both Expressway-C and Expressway-E devices. The material does not give further technical detail on the exact trigger.

Why it is dangerous: Exploitation can disrupt the video and collaboration service the device provides and may affect the network it sits on. Organizations running Expressway devices are at risk, especially internet-facing Expressway-E systems.

Are you affected?

You are affected if you run Cisco Expressway Core (Expressway-C) or Cisco Expressway Edge (Expressway-E) devices on a software version earlier than the October 2026 hardening release.

Cisco Expressway Series software (Expressway-C and Expressway-E) prior to the October 2026 hardening release. Specific affected version numbers: unknown.

What to do

  1. Check your current Expressway-C and Expressway-E software version against the Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs
  2. Install the Cisco October 2026 Expressway Series hardening update on all Expressway-C and Expressway-E devices
  3. Confirm the upgrade completed and the devices are running the fixed version
  4. Review the Cisco advisory for the other related CVEs in this release (CVE-2026-76490 to CVE-2026-76497)

Timeline

  1. 21 Oct 2026, 17:19 UTC
    Publicly disclosed
  2. 21 Oct 2026, 17:19 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 14:49 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  4. 27 Oct 2026, 14:49 UTC
    Confirmed by Cisco PSIRT

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-76493
CVSS
7.5 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 17:19 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 14:49 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Expressway: crashes from unhandled errors, exploited in the wild · Zero Radar